Using and Implementing Keyring Restrictions for Userspace
Talkat Linux Security Summit North America 2019 · on Wednesday, 2019-08-21· at 14:00· Sapphire D, Hilton San Diego Bayfront·
summary
Kernel keyrings gain a userspace-configurable restriction API (added around 4.12 with helpers in keyutils v1.5.11) that enforces which keys can be linked into a ring by checking signatures, key serials, or searching other keyrings; it’s used by iwd and ELL to validate certificate chains by linking DER certs into a verify ring and using a root cert ring as the signer set. Current implementation focuses on asymmetric key restrictions, supports a chain option, prepopulating rings, but has quota, performance, and validation caveats and a new TPM subtype.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:40Keys and key types
- 2:13Keyrings: A key for organizing keys
- 2:51The origin of keyring restrictions
- 4:59A restricted keyring use case
- 6:28Software versions with userspace restrictions
- 7:17Makeup of the restrict call
- 8:44Asymmetric Restriction Examples
- 10:33Certificate verification
- 14:18Additions to key types and keyrings
- 14:44Choose a key type to use for restriction lookup
- 16:18Implement restrict functions
- 17:29Considerations for restrict functions
- 18:31Implement a lookup function
- 19:36Considerations for lookup functions
- 20:35Other possibilities
- 22:59Questions?
related talks
35mOverview and Recent Developments of Keyrings Subsystem
32mEstablishing Trust in Linux Keyrings - Is Trust Built-in, Imputed, or Transitive?
27mCoupling Key-Ring and Linux Crypto-API Framework(LCF) via Crypto-Transformation(tfm)
26mIntegrity
30mKernel Hardening With Protection Keys
36mHiding Attestation with Linux Keyring in Confidential Virtual Machines
42mTPMs and the Linux Kernel: unlocking a better path to hardware security
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security